A collection of security process data
Security control implementation should be based on the outcome of risk assessment, and it is part of risk mitigation strategy. A strategy is based on the security policies, and the implementation and maintenance of a strategy is based on security procedures. One of the key requirements for security control is to demonstrate that the implemented control satisfies the requirements of the risk mitigation strategy, and in turn demonstrate adherence to established security policies and procedures.
Hence, a security control, whether technical, administrative, or physical, should provide sufficient data to establish that security policies and procedures are continuously and uniformly applied.
The data pertaining to a security control can be of two forms. One is data that is provided as an input to the control. The other is data that is generated or used during the process of an event and the output of control action. The input data can be a sample data or a...
